“Certain foreign actors are increasingly creating and exploiting vulnerabilities in the United States bulk-power system, which provides the electricity that supports our national defense, vital emergency services, critical infrastructure, and economy.”
The White House declared a national emergency to secure the U.S. bulk-power system, prohibiting foreign-produced grid equipment that poses an unacceptable risk and directing the Secretary of Energy to mitigate cyber and supply-chain threats to the grid. Signed August 26, 2026.
A coordinated cyberattack targeted more than 30 municipal water systems across Minnesota over two days in July 2026. Plymouth, South St. Paul, Maple Plain and Braham publicly confirmed the attacks. A preliminary report by U.S. investigators provisionally attributed them to Iranian hackers.
“The FBI told us we were one of 200.”
Nick Lawler, General Manager of a small Massachusetts water utility with no military connection, targeted anyway. China had been dormant on his network for years before the FBI knocked on his door.
“If you are willing to go after a small water provider in Littleton, Massachusetts, what other target is off the list?”
Former Director of the NSA and Commander of U.S. Cyber Command, in his first public interview after retirement, warning that every utility in America is a target.
“These state-sponsored actors are not just infiltrating networks, they are embedding themselves to enable long-term access, disruption, and potential sabotage.”
CISA, NSA and the Canadian Centre for Cyber Security jointly warned of BRICKSTORM, a Chinese backdoor targeting critical infrastructure that automatically reinstalls itself if removed.
New York became the first state in America to mandate OT cybersecurity for water and wastewater facilities, requiring network monitoring, incident reporting and OT/IT separation by law. Signed March 11, 2026. Compliance deadlines run through end of 2027. The era of voluntary OT security guidance is over.
The U.S. Coast Guard issued the first mandatory federal cybersecurity framework for ports, vessels and waterfront facilities, requiring OT asset inventories, incident reporting and network monitoring. Effective July 16, 2025. Cybersecurity plans due July 2027.
Nearly 170,000 U.S. water systems face cyber risk. A federal audit found critical or high-severity vulnerabilities in 97 drinking water systems serving 27 million Americans. Less than 25% of water and wastewater operators perform annual cybersecurity risk assessments. Most have no OT visibility at all.
“The Salt and Volt Typhoon intrusions revealed significant gaps in our cybersecurity posture, compromising Americans' private data and key sectors of our critical infrastructure.”
House Homeland Security Committee hearing on the 2026 DHS budget, as Congress acknowledged escalating Chinese OT threats while the administration proposed cutting CISA funding by $491 million.